Status · Plans and data

Data and privacy

Status keeps what it needs to tell you how your monitors are and were: their checks, their changes between up and down, and the people to tell. Nothing runs on your servers but the calls you make.

What Status keeps

What Status keeps:

Monitor names and the addresses they check
Check results: status code, time taken, error
Changes between up and down, with their reasons
A failed check's answer: headers, body start, timings, IP
Job output sent with a ping: its last 10 KB

How long: Check results, with a failed check's answer and a job's output, and webhook deliveries for 30 days. Each day's uptime figures and every change between up and down are kept with no end date. The audit log is kept for 24 months.

Where: Germany

Who else processes it: Keyweb AG (Rents us the servers the data is stored and processed on., Germany); Telegram (Only if you add a Telegram chat: delivers alerts, with the monitor's name, what it checks and why it is down., United Arab Emirates); Slack (Only if you add a Slack webhook: delivers alerts, with the monitor's name, what it checks and why it is down., United States)

A ping keeps its time and whether the job succeeded; a job that sends its output with the ping has its last 10 KB kept with it. A failed check keeps the start of the answer it got, for its page. The public status page shows names and states, never addresses. A Telegram bot token, a Slack webhook and each webhook secret are kept encrypted.

We process it on your behalf under our data processing terms.

Loading what it keeps…

What a check keeps

Every check keeps when it ran, whether it passed, the status code, how long the answer took, and the reason when it failed.

A failed check also keeps the answer as it came, so its page can show where to look:

its status and a few headers that say who answered and why (content-type, server, location, retry-after, cache-control, cf-ray, x-request-id, via),
the first 2 KB of the body,
how long the name lookup, the connection, TLS and the first byte took,
the IP address it reached.

An HTTPS check also keeps the certificate it met: who issued it and when it expires. Checks are kept for as long as the list above says, then deleted.

Keep secrets out of addresses

A monitor's address is shown to everyone who may open the project, and it's in the alerts sent to Telegram and Slack. Don't check an address with a password or a key in it: give the health route its own public answer instead.

What a ping keeps

A ping keeps when it came, and whether it reported a success or a failure, with its exit code. A start only marks the run as started. A POST's body is your job's output: its last 10 KB are kept with the ping, and shown on the heartbeat's page to everyone who may open the project. Pings are kept and deleted as checks are.

Output is kept as it is

Status doesn't look into a job's output or remove anything from it. Send only output that prints no passwords, keys or personal data.

Keys and secrets

A server secret is kept only as a hash. It's shown once, when it's made, and never again.
A Telegram bot token, a Slack webhook, an Incidents server secret and each webhook signing secret are kept encrypted with a key of Status's own. None is shown again in full.
Making a server secret or a webhook endpoint asks for a sign-in at id.my-beast.com within the last 15 minutes, because the next page shows the secret.

What is public

Only the project's status page, and only for the monitors you mark public: their names and groups there, their states, their days and their downtimes. It never shows an address, a reason, a check's answer or who was told. Its feed and badge show the same. Everything else needs a sign-in, and is shown only to the project's people.

Status keeps no data about your own users, unless you put some in a monitor's name or address, or in a job's output.

Erasing data

A monitor: remove it on its page, or leave it out of the deploy's list. Its checks stop at once, and its check results are deleted as they age, like all others. Its daily uptime figures and its changes between up and down are kept, as the list above says.
A person on your team: their name and email come from id.my-beast.com, with the project's people. Remove them from the project there, and Status stops telling them and lets them in no more. The audit log keeps what they did, for as long as the list above says.
Anything else, or a whole project's data: write to us. Our data processing terms say what happens to the data when the service ends.